Update go.mod dependencies

[josephlr]

For some reason this added 151 lines to go.sum, but I don't think that's a big deal

Signed-off-by: Joe Richey joerichey@google.com

[ChriMarMe]

Did you do?

go mod tidy

[josephlr]

Did you do?

go mod tidy

Yes I did, it didn't change anything

EDIT: Deleting go.sum and running go mod tidy also didn't change anything. Maybe I just shouldn't expect go.sum to look reasonable.

[ChriMarMe]

I tried that too. go.sum --> 💩

EDIT: I will make a guess: in go.sum we will see all dependencies, and with all, I mean all....dependencies of dependencies of dependencies.

[josephlr]

I tried that too. go.sum -->

Ya, it looks like go.sum will always just have a lot of lines (basically every version of every transitive dep ever used). This sucks, but it seems to be the way things are.

[ChriMarMe]

go mod is just a behemoth 🤷

[ChriMarMe]

From Go Modules Reference

A module may have a text file named go.sum in its root directory, alongside its go.mod file. The go.sum file contains cryptographic hashes of the module's direct and indirect dependencies. When the go command downloads a module .mod or .zip file into the module cache, it computes a hash and checks that the hash matches the corresponding hash in the main module's go.sum file. go.sum may be empty or absent if the module has no dependencies or if all dependencies are replaced with local directories using replace directives.

[josephlr]

@chrisfenner or @twitchy-jsonp it looks like I need a CODEOWNERS approval to merge this.